@harrylabsj/kiwi-merchant-cloud 0.12.0

package/app/cloud/merchant-connect.js

@@ -0,0 +1,331 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** 独立 Merchant Runtime 的设备授权、自动绑定和名片发布。 */
+import { isIP } from "node:net";
+import { validateAgentCard } from "../discovery/agent-card/validate.js";
+import { loadOrCreateA2aSigningIdentity, toJwsSigningIdentity } from "../a2a/signing-key.js";
+import { writeFileAtomic } from "../fs/atomic-write.js";
+import { canonicalize } from "../negotiation/jcs.js";
+import { CatalogClient, runtimePublicKey } from "./catalog-client.js";
+import { enrollmentStorePath, readEnrollmentStore } from "./binding/enrollment-challenge.js";
+import { createHash } from "node:crypto";
+import { isRedirectResponse, readJsonBody } from "../net/safe-http.js";
+export class MerchantConnectError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MerchantConnectError";
+    }
+}
+function parsePublicOrigin(raw) {
+    if (raw === undefined || raw.trim() === "") {
+        throw new MerchantConnectError("PUBLIC_ORIGIN_MISSING", "商家服务还没有可用的公网 HTTPS 入口，买家暂时无法连接并询价。请先运行 `kiwi merchant setup-public` 查看 DNS/Caddy 配置指引，或使用 WorkBuddy 云端应用；完成后重新运行 `kiwi merchant connect`，已有资料会保留。地址格式通过不代表外部可访问，Catalog 还会执行真实端点挑战。");
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new MerchantConnectError("PUBLIC_ORIGIN_INVALID", "公网入口不是合法 URL；请设置 KIWI_A2A_PUBLIC_URL=https://你的域名");
+    }
+    const host = url.hostname.toLowerCase();
+    const normalizedHost = host.replace(/^\[|\]$/g, "");
+    const ip = isIP(normalizedHost);
+    const octets = ip === 4 ? normalizedHost.split(".").map(Number) : [];
+    const privateIpv4 = ip === 4 && (octets[0] === 0 || octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 ||
+        octets[0] === 192 && octets[1] === 168 || octets[0] === 172 && (octets[1] ?? 0) >= 16 && (octets[1] ?? 0) <= 31 ||
+        octets[0] === 100 && (octets[1] ?? 0) >= 64 && (octets[1] ?? 0) <= 127 || (octets[0] ?? 0) >= 224);
+    const privateIpv6 = ip === 6 && (normalizedHost === "::" || normalizedHost === "::1" || normalizedHost.startsWith("fc") ||
+        normalizedHost.startsWith("fd") || normalizedHost.startsWith("fe80:") || normalizedHost.startsWith("::ffff:"));
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash ||
+        (url.pathname !== "/" && url.pathname !== "") || host === "localhost" || host.endsWith(".localhost") ||
+        host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".lan") || host.endsWith(".home") ||
+        !host.includes(".") || privateIpv4 || privateIpv6) {
+        throw new MerchantConnectError("PUBLIC_ORIGIN_INVALID", "商家服务尚未配置可用的公网 HTTPS origin。请运行 `kiwi merchant setup-public` 查看入口配置指引；资料已保留，配置后重新运行连接命令。");
+    }
+    return url.origin;
+}
+function writeState(dataDir, state) {
+    writeFileAtomic(enrollmentStorePath(dataDir), `${JSON.stringify(state)}\n`, { mode: 0o600 });
+}
+function stateSession(dataDir, enrollmentId) {
+    const store = readEnrollmentStore(dataDir);
+    const value = store.sessions.find((s) => s.enrollment_id === enrollmentId);
+    return value;
+}
+/** Pure resume selection: only the same thumbprint+origin can reuse a grant/device code. */
+export function selectReusableEnrollment(sessions, input) {
+    return sessions.find((session) => {
+        const state = session;
+        return state.runtime_origin === input.runtimeOrigin && state.key_thumbprint === input.keyThumbprint &&
+            ["preparing", "authorized", "bound", "published"].includes(state.status) &&
+            (state.status === "published" || Number.isFinite(Date.parse(state.expires_at)) && Date.parse(state.expires_at) > input.nowMs);
+    });
+}
+/** Keep the Catalog account's single-agent identity through key loss and address migration. */
+export function priorPublishedCatalogAgentId(sessions) {
+    const ids = new Set(sessions
+        .map((session) => session)
+        .filter((session) => session.status === "published" && typeof session.catalog_agent_id === "string")
+        .map((session) => session.catalog_agent_id));
+    if (ids.size > 1)
+        throw new MerchantConnectError("AMBIGUOUS_MIGRATION", "本Runtime已有多个Catalog Agent历史绑定；请在Catalog先确认要迁移的商家身份。");
+    return ids.values().next().value;
+}
+async function verifyPublicRuntimeReady(origin, expectedEndpoint, identity, fetchImpl = globalThis.fetch) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 8_000);
+    const url = `${origin}/.well-known/agent-card.json`;
+    try {
+        const response = await fetchImpl(url, { method: "GET", redirect: "manual", signal: controller.signal, headers: { accept: "application/json" } });
+        if (isRedirectResponse(response) || !response.ok) {
+            throw new MerchantConnectError("RUNTIME_UNREACHABLE", `暂时无法从外部读取商家服务的 Agent Card（HTTP ${response.status}）。请确认服务已启动且公网入口可访问，然后重新运行 kiwi merchant connect。`);
+        }
+        const card = validateAgentCard(await readJsonBody(response, { signal: controller.signal }));
+        const urls = card.supportedInterfaces.map((entry) => entry.url);
+        if (typeof card.url !== "string" || new URL(card.url).origin !== origin || !urls.includes(expectedEndpoint)) {
+            throw new MerchantConnectError("RUNTIME_NOT_READY", "公网入口返回的 Agent Card 与当前 Runtime 地址不一致；未发布名片。请检查反向代理与服务配置后重试。");
+        }
+        const signatureScheme = card.securitySchemes?.["kiwi-signature"];
+        if (signatureScheme !== undefined && (signatureScheme.type !== "kiwi-http-message-signature" ||
+            signatureScheme.keyid !== identity.keyid ||
+            signatureScheme.publicKeyPem !== identity.publicKeyPem ||
+            signatureScheme.algorithm !== "ed25519")) {
+            throw new MerchantConnectError("RUNTIME_IDENTITY_MISMATCH", "公网服务的 A2A 签名声明与当前 Runtime 持久密钥不一致；未发布名片。请在实际承接请求的 Runtime 主机上运行连接命令。");
+        }
+        return card;
+    }
+    catch (err) {
+        if (err instanceof MerchantConnectError)
+            throw err;
+        throw new MerchantConnectError("RUNTIME_UNREACHABLE", `暂时无法从外部连接你的商家服务（${err instanceof Error ? err.message : String(err)}）。请确认服务已启动、TLS 证书有效且允许公网访问，然后重试。`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** 失败时保留设备状态、许可与绑定回执；重跑命令按相同 enrollment 继续。 */
+export async function connectMerchant(options) {
+    if (options.profile.role !== "merchant")
+        throw new MerchantConnectError("PROFILE_NOT_MERCHANT", "kiwi merchant connect 需要 merchant profile");
+    const origin = parsePublicOrigin(options.publicOrigin ?? process.env.KIWI_A2A_PUBLIC_URL);
+    const endpoint = `${origin}/a2a`;
+    const identityRaw = loadOrCreateA2aSigningIdentity(options.dataDir, origin);
+    const identity = { signingIdentity: toJwsSigningIdentity(identityRaw), keyId: identityRaw.keyid };
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const client = new CatalogClient({ baseUrl: options.catalogUrl, fetchImpl });
+    const output = options.output ?? ((line) => process.stdout.write(`${line}\n`));
+    const now = options.now ?? (() => new Date());
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const { keyThumbprint } = runtimePublicKey(identity);
+    // 公开预览直接取运行中的真实 Agent Card，避免按 CLI 配置猜测 bearer/signature 能力。
+    let card = await verifyPublicRuntimeReady(origin, endpoint, identityRaw, fetchImpl);
+    const catalogOrigin = new URL(options.catalogUrl).origin;
+    const store = readEnrollmentStore(options.dataDir);
+    let state = selectReusableEnrollment(store.sessions, { runtimeOrigin: origin, keyThumbprint, nowMs: now().getTime() });
+    if (state !== undefined) {
+        if (state.catalog_origin !== catalogOrigin)
+            throw new MerchantConnectError("CATALOG_MISMATCH", "待续办的接入任务属于另一个 Catalog；为防止许可串用，已停止。");
+        if (state.frozen_card === undefined || typeof state.preview_digest !== "string")
+            throw new MerchantConnectError("STATE_INVALID", "持久接入任务缺少冻结的公开名片，已停止。");
+        const frozenDigest = `sha256:${createHash("sha256").update(canonicalize(state.frozen_card), "utf8").digest("hex")}`;
+        if (frozenDigest !== state.preview_digest)
+            throw new MerchantConnectError("STATE_INVALID", "持久化的已批准名片摘要不匹配，已停止。");
+        const currentDigest = `sha256:${createHash("sha256").update(canonicalize(card), "utf8").digest("hex")}`;
+        if (currentDigest !== state.preview_digest) {
+            throw new MerchantConnectError(state.status === "published" ? "RUNTIME_CARD_CHANGED" : "PREVIEW_CHANGED", "公网服务当前的 Agent Card 与已批准预览不同；请核对变更并重新授权，Runtime不会静默更改已公开信息。");
+        }
+        card = state.frozen_card;
+        const existingAgentId = state.catalog_agent_id;
+        const existingBindingId = state.binding_id;
+        const existingCardRevision = state.card_revision;
+        if (state.status === "published" && existingAgentId !== undefined && existingBindingId !== undefined && existingCardRevision !== undefined) {
+            const active = await client.fetchPublicBinding(existingAgentId);
+            if (active === null || active.bindingId !== existingBindingId || active.keyThumbprint !== keyThumbprint ||
+                active.runtimeOrigin.replace(/\/+$/, "") !== origin || active.cardRevision !== existingCardRevision ||
+                !Number.isFinite(Date.parse(active.expiresAt)) || Date.parse(active.expiresAt) <= now().getTime() ||
+                !["ACTIVE", "active"].includes(active.publicationState)) {
+                throw new MerchantConnectError("PUBLICATION_NOT_ACTIVE", "Catalog 当前没有返回这条绑定和已激活名片；服务可能已暂停或撤回。请到Catalog恢复服务后再检查，Runtime不会自动恢复营业。");
+            }
+            if (state.merchant_id === undefined) {
+                state = { ...state, merchant_id: active.merchantId };
+                const latest = readEnrollmentStore(options.dataDir);
+                latest.sessions = latest.sessions.map((s) => s.enrollment_id === state?.enrollment_id ? state : s);
+                writeState(options.dataDir, latest);
+            }
+            else if (state.merchant_id !== active.merchantId) {
+                throw new MerchantConnectError("BINDING_MERCHANT_MISMATCH", "Catalog binding的merchant_id与本地Enrollment不一致，已停止。");
+            }
+            return { agentId: existingAgentId, bindingId: existingBindingId, cardRevision: existingCardRevision };
+        }
+    }
+    if (state === undefined) {
+        const expectedCatalogAgentId = priorPublishedCatalogAgentId(store.sessions);
+        const session = await client.createDeviceEnrollment({
+            runtimeOrigin: origin,
+            a2aEndpoint: endpoint,
+            generation: 1,
+            serviceEpoch: 1,
+            publicPreview: card,
+            publicProfileRevision: 1,
+        }, identity);
+        state = {
+            enrollment_id: session.enrollmentId,
+            runtime_origin: origin,
+            key_thumbprint: keyThumbprint,
+            catalog_origin: catalogOrigin,
+            preview_digest: `sha256:${createHash("sha256").update(canonicalize(card), "utf8").digest("hex")}`,
+            frozen_card: card,
+            ...(expectedCatalogAgentId !== undefined ? { expected_catalog_agent_id: expectedCatalogAgentId } : {}),
+            expires_at: session.expiresAt,
+            status: "preparing",
+            device_code: session.deviceCode,
+            user_code: session.userCode,
+            verification_uri: session.verificationUri,
+            interval: session.intervalSeconds,
+        };
+        store.sessions = [...store.sessions.filter((s) => s.status === "bound" || s.status === "published"), state];
+        writeState(options.dataDir, store);
+    }
+    if (state.status === "preparing") {
+        output(`即将授权连接 ${options.profile.name ?? options.profile.agent_id}（配对码 ${state.user_code}）。请在 Catalog 页面确认店铺公开信息；不要把配对码发给他人。`);
+        options.openBrowser?.(state.verification_uri);
+        output(`授权页面：${state.verification_uri}`);
+        output(`Runtime 已开始等待登录与一次「连接此服务并发布」确认；可 Ctrl+C 后重新运行命令继续。`);
+        const deadline = Math.min(Date.parse(state.expires_at), now().getTime() + (options.timeoutMs ?? 10 * 60_000));
+        let interval = state.interval * 1000;
+        while (now().getTime() < deadline) {
+            const result = await client.pollDeviceEnrollment(state.device_code, identity);
+            if (result.status === "slow_down")
+                interval = Math.max(interval + 5_000, result.intervalSeconds * 1000);
+            else if (result.status === "authorization_pending")
+                interval = Math.max(interval, result.intervalSeconds * 1000);
+            else if (result.status === "authorized") {
+                if (result.enrollmentId !== state.enrollment_id || result.runtimeOrigin !== origin || result.a2aEndpoint !== endpoint ||
+                    result.merchantId.trim() === "" ||
+                    state.expected_catalog_agent_id !== undefined && result.catalogAgentId !== state.expected_catalog_agent_id) {
+                    throw new MerchantConnectError("AUTHORIZED_MATERIAL_MISMATCH", "Catalog 授权材料与当前 Runtime 不一致，已停止连接。");
+                }
+                if (result.authorizationEpoch < 1 || result.approvedCardDigest !== state.preview_digest ||
+                    !result.scopes.includes("runtime:bind") || !result.scopes.includes("card:publish") ||
+                    !result.scopes.includes("heartbeat")) {
+                    throw new MerchantConnectError("GRANT_SCOPE_INVALID", "Catalog 接入许可缺少有效授权代次或必要范围，已停止。");
+                }
+                state = { ...state, status: "authorized", catalog_agent_id: result.catalogAgentId, merchant_id: result.merchantId, grant: result.grant, authorization_epoch: result.authorizationEpoch, expires_at: result.expiresAt };
+                const latest = readEnrollmentStore(options.dataDir);
+                latest.sessions = latest.sessions.map((s) => s.enrollment_id === state?.enrollment_id ? state : s);
+                writeState(options.dataDir, latest);
+                break;
+            }
+            await sleep(interval);
+        }
+    }
+    state = stateSession(options.dataDir, state.enrollment_id) ?? state;
+    if (state.status === "preparing")
+        throw new MerchantConnectError("AUTHORIZATION_PENDING", "尚未完成商家授权。会话已保存，运行 kiwi merchant connect 可继续。");
+    if (state.status === "authorized") {
+        if (state.grant === undefined || state.catalog_agent_id === undefined || state.authorization_epoch === undefined || state.merchant_id === undefined)
+            throw new MerchantConnectError("STATE_INVALID", "本地授权状态缺少许可、授权代次、merchant_id或 catalog_agent_id");
+        const binding = await client.bindEnrollment({
+            enrollmentId: state.enrollment_id,
+            grant: state.grant,
+            catalogAgentId: state.catalog_agent_id,
+            merchantId: state.merchant_id,
+            runtimeOrigin: origin,
+            a2aEndpoint: endpoint,
+            generation: 1,
+            serviceEpoch: 1,
+            authorizationEpoch: state.authorization_epoch,
+        }, identity);
+        if (binding.keyThumbprint !== keyThumbprint)
+            throw new MerchantConnectError("BINDING_KEY_MISMATCH", "Catalog 绑定回执的密钥与本 Runtime 不一致");
+        const rawClaims = binding.bindingClaim["claims"];
+        const claimMerchantId = rawClaims !== null && typeof rawClaims === "object" && !Array.isArray(rawClaims)
+            ? rawClaims["merchant_id"]
+            : undefined;
+        if (typeof claimMerchantId !== "string" || claimMerchantId.trim() === "") {
+            throw new MerchantConnectError("BINDING_CLAIM_INVALID", "Catalog已签名绑定声明缺少merchant_id；名片保持未发布。");
+        }
+        state = {
+            ...state,
+            status: "bound",
+            binding_id: binding.bindingId,
+            merchant_id: claimMerchantId,
+            expected_card_revision: binding.activeCardRevision ?? 0,
+        };
+        const latest = readEnrollmentStore(options.dataDir);
+        latest.sessions = latest.sessions.map((s) => {
+            if (s.enrollment_id === state?.enrollment_id)
+                return state;
+            const old = s;
+            return old.status === "published" && old.catalog_agent_id === state?.catalog_agent_id &&
+                old.binding_id !== state?.binding_id
+                ? { ...old, status: "replaced" }
+                : s;
+        });
+        writeState(options.dataDir, latest);
+    }
+    if (state.status === "bound") {
+        if (state.catalog_agent_id === undefined || state.binding_id === undefined)
+            throw new MerchantConnectError("STATE_INVALID", "绑定状态缺少回执字段");
+        const catalogAgentId = state.catalog_agent_id;
+        const bindingId = state.binding_id;
+        const expectedRevision = state.expected_card_revision ?? 0;
+        const currentCard = await verifyPublicRuntimeReady(origin, endpoint, identityRaw, fetchImpl);
+        if (canonicalize(currentCard) !== canonicalize(card)) {
+            throw new MerchantConnectError("PREVIEW_CHANGED", "公网服务的公开 Agent Card 已不同于商家批准的预览；未发布名片。请重新检查并授权新的公开信息。");
+        }
+        let cardRevision = state.card_revision;
+        if (cardRevision === undefined) {
+            const publication = await client.publishCard({
+                agentId: catalogAgentId,
+                bindingId,
+                generation: 1,
+                expectedRevision,
+                agentCard: card,
+                a2aEndpoint: endpoint,
+                runtimeOrigin: origin,
+            }, identity);
+            if (publication.revision === null)
+                throw new MerchantConnectError("PUBLICATION_RECEIPT_INVALID", "Catalog 未返回名片 revision；绑定已保留，重试可续办");
+            cardRevision = publication.revision;
+            state = { ...state, card_revision: cardRevision };
+            const latest = readEnrollmentStore(options.dataDir);
+            latest.sessions = latest.sessions.map((s) => s.enrollment_id === state?.enrollment_id ? state : s);
+            writeState(options.dataDir, latest);
+        }
+        if (cardRevision === undefined)
+            throw new MerchantConnectError("STATE_INVALID", "持久名片状态缺 revision");
+        const activated = await client.activateCard({
+            agentId: catalogAgentId,
+            bindingId,
+            cardRevision,
+            expectedRevision,
+        }, identity);
+        if (activated.revision === null)
+            throw new MerchantConnectError("ACTIVATION_RECEIPT_INVALID", "Catalog 未确认名片激活；绑定已保留，重试可续办");
+        state = { ...state, status: "published", card_revision: activated.revision };
+        const latest = readEnrollmentStore(options.dataDir);
+        latest.sessions = latest.sessions.map((s) => s.enrollment_id === state?.enrollment_id ? state : s);
+        writeState(options.dataDir, latest);
+    }
+    if (state.status !== "published" || state.catalog_agent_id === undefined || state.binding_id === undefined || state.card_revision === undefined) {
+        throw new MerchantConnectError("STATE_INCOMPLETE", "连接流程尚未完成，未显示已上线。");
+    }
+    return { agentId: state.catalog_agent_id, bindingId: state.binding_id, cardRevision: state.card_revision };
+}
+//# sourceMappingURL=merchant-connect.js.map

package/app/cloud/merchant-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merchant-connect.js","sourceRoot":"","sources":["../../src/cloud/merchant-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,2CAA2C;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAgC,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAA4D,MAAM,mCAAmC,CAAC;AACvJ,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,IAAY,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAqBD,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,qLAAqL,CAAC,CAAC;IACjP,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACjC,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,WAAW,GAAG,EAAE,KAAK,CAAC,IAAI,CAC9B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAClG,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAC/G,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAClG,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,KAAK,CAAC,IAAI,CAC9B,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,KAAK,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC;QACtF,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAC9G,CAAC;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QACnF,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACpG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,yFAAyF,CAAC,CAAC;IACrJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAA+B;IAClE,eAAe,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,YAAoB;IACzD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC;IAC3E,OAAO,KAAiC,CAAC;AAC3C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,wBAAwB,CACtC,QAAyC,EACzC,KAAsE;IAEtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,OAAuB,CAAC;QACtC,OAAO,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa;YACjG,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACxE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAClI,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,4BAA4B,CAAC,QAAyC;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ;SACzB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAuB,CAAC;SACzC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC;SACnG,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAiB,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,qDAAqD,CAAC,CAAC;IAC/H,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAc,EACd,gBAAwB,EACxB,QAAiD,EACjD,YAA0B,UAAU,CAAC,KAAK;IAE1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,MAAM,8BAA8B,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACjJ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,kCAAkC,QAAQ,CAAC,MAAM,kDAAkD,CAAC,CAAC;QAC7J,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,6DAA6D,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,gBAAgB,CAAC,CAAC;QACjE,IAAI,eAAe,KAAK,SAAS,IAAI,CACnC,eAAe,CAAC,IAAI,KAAK,6BAA6B;YACtD,eAAe,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YACxC,eAAe,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;YACtD,eAAe,CAAC,SAAS,KAAK,SAAS,CACxC,EAAE,CAAC;YACF,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,sEAAsE,CAAC,CAAC;QACtI,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB;YAAE,MAAM,GAAG,CAAC;QACnD,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC/J,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAeD,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,GAAG,MAAM,MAAM,CAAC;IACjC,MAAM,WAAW,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;IAClG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrD,6DAA6D;IAC7D,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACpF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAA6B,CAAC;IAEnJ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,cAAc,KAAK,aAAa;YAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,oCAAoC,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACzJ,MAAM,YAAY,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpH,IAAI,YAAY,KAAK,KAAK,CAAC,cAAc;YAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QAClH,MAAM,aAAa,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxG,IAAI,aAAa,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,IAAI,oBAAoB,CAC5B,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,EACzE,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;QACzB,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC/C,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC3C,MAAM,oBAAoB,GAAG,KAAK,CAAC,aAAa,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,eAAe,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC3I,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa;gBACnG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,oBAAoB;gBACnG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;gBACjG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,wEAAwE,CAAC,CAAC;YACrI,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACpC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnH,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,kDAAkD,CAAC,CAAC;YAClH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC;QACxG,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,OAAO,GAA4B,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAC3E,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,IAA0C;YACzD,qBAAqB,EAAE,CAAC;SACzB,EAAE,QAAQ,CAAC,CAAC;QACb,KAAK,GAAG;YACN,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,aAAa;YAC7B,cAAc,EAAE,aAAa;YAC7B,cAAc,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACjG,WAAW,EAAE,IAAI;YACjB,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtG,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,OAAO,CAAC,eAAe;YACzC,QAAQ,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5G,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,QAAQ,KAAK,CAAC,SAAS,qCAAqC,CAAC,CAAC;QAC/H,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAC9G,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;iBACnG,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB;gBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;iBAC5G,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ;oBACjH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;oBAC/B,KAAK,CAAC,yBAAyB,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,yBAAyB,EAAE,CAAC;oBAC/G,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,oCAAoC,CAAC,CAAC;gBACvG,CAAC;gBACD,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,KAAK,CAAC,cAAc;oBACnF,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAClF,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;gBAC1F,CAAC;gBACD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvN,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnH,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;YACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,8CAA8C,CAAC,CAAC;IAC1I,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QACtP,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;YAC1C,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,gBAAgB;YACtC,UAAU,EAAE,KAAK,CAAC,WAAW;YAC7B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,kBAAkB,EAAE,KAAK,CAAC,mBAAmB;SAC9C,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa;YAAE,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACtG,CAAC,CAAE,SAAqC,CAAC,aAAa,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;QAClG,CAAC;QACD,KAAK,GAAG;YACN,GAAG,KAAK;YACR,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,WAAW,EAAE,eAAe;YAC5B,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,IAAI,CAAC;SACxD,CAAC;QACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK,EAAE,aAAa;gBAAE,OAAO,KAAqB,CAAC;YAC3E,MAAM,GAAG,GAAG,CAAiB,CAAC;YAC9B,OAAO,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,gBAAgB,KAAK,KAAK,EAAE,gBAAgB;gBACnF,GAAG,CAAC,UAAU,KAAK,KAAK,EAAE,UAAU;gBACpC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,UAAmB,EAAE;gBACzC,CAAC,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1I,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC,sBAAsB,IAAI,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7F,IAAI,YAAY,CAAC,WAAW,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC;QACvC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBAC3C,OAAO,EAAE,cAAc;gBACvB,SAAS;gBACT,UAAU,EAAE,CAAC;gBACb,gBAAgB;gBAChB,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,QAAQ;gBACrB,aAAa,EAAE,MAAM;aACtB,EAAE,QAAQ,CAAC,CAAC;YACb,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,EAAE,oCAAoC,CAAC,CAAC;YACvI,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC;YACpC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnH,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YAC1C,OAAO,EAAE,cAAc;YACvB,SAAS;YACT,YAAY;YACZ,gBAAgB;SACjB,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAAC;QAC7H,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnH,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAChJ,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;AAC7G,CAAC"}

package/app/cloud/merchant-identity.d.ts

@@ -0,0 +1,14 @@
+import type { AgentProfile } from "../config/profile.js";
+export interface PersistedMerchantIdentity {
+    schema_version: 1;
+    agent_id: string;
+    owner_id: string;
+    created_at: string;
+    display_name?: string;
+    merchant_name_needs_update?: boolean;
+}
+export declare function merchantIdentityPath(dataDir: string): string;
+/** 首次启动固定身份；后续重部署一律以状态目录中的身份为准。 */
+export declare function loadOrCreateMerchantIdentity(dataDir: string, profile: AgentProfile, options?: {
+    merchantNameNeedsUpdate?: boolean;
+}): AgentProfile;

package/app/cloud/merchant-identity.js

@@ -0,0 +1,76 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { writeFileAtomic } from "../fs/atomic-write.js";
+export function merchantIdentityPath(dataDir) {
+    return path.join(dataDir, "merchant-identity.json");
+}
+function readIdentity(file) {
+    const value = JSON.parse(readFileSync(file, "utf8"));
+    if (value.schema_version !== 1 ||
+        typeof value.agent_id !== "string" || value.agent_id.trim() === "" ||
+        typeof value.owner_id !== "string" || value.owner_id.trim() === "" ||
+        typeof value.created_at !== "string" || Number.isNaN(Date.parse(value.created_at)))
+        throw new Error("商家身份状态文件格式无效；拒绝使用部署目录中的新身份覆盖状态");
+    chmodSync(file, 0o600);
+    return value;
+}
+/** 首次启动固定身份；后续重部署一律以状态目录中的身份为准。 */
+export function loadOrCreateMerchantIdentity(dataDir, profile, options = {}) {
+    const file = merchantIdentityPath(dataDir);
+    if (existsSync(file)) {
+        const identity = readIdentity(file);
+        const preserveExistingName = options.merchantNameNeedsUpdate === true;
+        const displayName = preserveExistingName ? identity.display_name ?? profile.name : profile.name;
+        const nameNeedsUpdate = preserveExistingName
+            ? identity.merchant_name_needs_update ?? true
+            : false;
+        const updated = {
+            ...identity,
+            ...(displayName !== undefined ? { display_name: displayName } : {}),
+            merchant_name_needs_update: nameNeedsUpdate,
+        };
+        if (JSON.stringify(updated) !== JSON.stringify(identity))
+            writeFileAtomic(file, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
+        return {
+            ...profile,
+            agent_id: identity.agent_id,
+            owner_id: identity.owner_id,
+            ...(displayName !== undefined ? { name: displayName } : {}),
+        };
+    }
+    mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+    // WP23 已有状态目录保存 admin credentials，但尚无 merchant-identity.json。
+    // 用这份既有 principal/merchant pair 作一次迁移，避免首次 WP5 升级换身份。
+    const credentialsFile = path.join(dataDir, "admin-credentials.json");
+    let initialIdentity = { agent_id: profile.agent_id, owner_id: profile.owner_id };
+    if (existsSync(credentialsFile)) {
+        const credentials = JSON.parse(readFileSync(credentialsFile, "utf8"));
+        if (typeof credentials.principal_id !== "string" || credentials.principal_id.trim() === "" ||
+            typeof credentials.merchant_id !== "string" || credentials.merchant_id.trim() === "")
+            throw new Error("管理员凭据缺少身份字段；拒绝用新部署身份覆盖旧运行身份");
+        initialIdentity = { agent_id: credentials.principal_id, owner_id: credentials.merchant_id };
+    }
+    const identity = {
+        schema_version: 1,
+        ...initialIdentity,
+        created_at: new Date().toISOString(),
+        ...(profile.name !== undefined ? { display_name: profile.name } : {}),
+        merchant_name_needs_update: options.merchantNameNeedsUpdate === true,
+    };
+    try {
+        writeFileSync(file, `${JSON.stringify(identity, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        chmodSync(file, 0o600);
+        return {
+            ...profile,
+            agent_id: initialIdentity.agent_id,
+            owner_id: initialIdentity.owner_id,
+        };
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const winner = readIdentity(file);
+        return { ...profile, agent_id: winner.agent_id, owner_id: winner.owner_id };
+    }
+}
+//# sourceMappingURL=merchant-identity.js.map

package/app/cloud/merchant-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merchant-identity.js","sourceRoot":"","sources":["../../src/cloud/merchant-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuC,CAAC;IAC3F,IACE,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAClE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAClE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAkC,CAAC;AAC5C,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,OAAqB,EACrB,UAAiD,EAAE;IAEnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC;QACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAChG,MAAM,eAAe,GAAG,oBAAoB;YAC1C,CAAC,CAAC,QAAQ,CAAC,0BAA0B,IAAI,IAAI;YAC7C,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,OAAO,GAA8B;YACzC,GAAG,QAAQ;YACX,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,0BAA0B,EAAE,eAAe;SAC5C,CAAC;QACF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1I,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,8DAA8D;IAC9D,sDAAsD;IACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,eAAe,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjF,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAA4B,CAAC;QACjG,IACE,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;YACtF,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;YACpF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,eAAe,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAA8B;QAC1C,cAAc,EAAE,CAAC;QACjB,GAAG,eAAe;QAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,0BAA0B,EAAE,OAAO,CAAC,uBAAuB,KAAK,IAAI;KACrE,CAAC;IACF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/app/cloud/onboarding/catalog-pipeline.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OnboardingStore } from "./store.js";
+import type { AuthoritativeEvidence, OnboardingRecord } from "./types.js";
+import { CatalogClient, type PublicBinding, type RuntimeSigningIdentity } from "../catalog-client.js";
+/** 证据流里的断点标记（summary 前缀；只留痕，不作状态依据）。 */
+export declare const BINDING_REQUESTED_MARKER = "catalog:binding-requested";
+export declare const AWAITING_CONFIRMATION_MARKER = "catalog:awaiting-portal-confirmation";
+export declare const PENDING_PUBLICATION_MARKER = "pending_publication";
+export type CatalogPipelineErrorCode = 
+/** 记录状态不在本动作的准入集合里。 */
+"STATE_NOT_ADMISSIBLE"
+/** 记录还没有平台 applicationId（平台授权步骤未完成）——不构成权威证据。 */
+ | "MISSING_PLATFORM_IDENTITY"
+/** 公开读地址上没有与本实例匹配的已确认绑定——未确认不发布。 */
+ | "BINDING_NOT_CONFIRMED"
+/** 发布回执缺 card_revision（契约违例）——无法激活，需人工核对。 */
+ | "PUBLISH_RECEIPT_INVALID"
+/** 服务检查能力未配置——禁止成功空实现。 */
+ | "SERVICE_CHECK_UNAVAILABLE";
+export declare class CatalogPipelineError extends Error {
+    readonly code: CatalogPipelineErrorCode;
+    constructor(code: CatalogPipelineErrorCode, message: string);
+}
+export interface CatalogPipelineDeps {
+    store: OnboardingStore;
+    client: CatalogClient;
+    /** Runtime 自持身份（与 CatalogClient 同一把 Ed25519 钥匙）。 */
+    identity: RuntimeSigningIdentity;
+    /** 运行时公开 origin——**只取自 KIWI_CLOUD_PUBLIC_ORIGIN**。 */
+    runtimeOrigin: string;
+    /** 独立授权会话及挑战状态的 0700/0600 持久目录。 */
+    dataDir?: string;
+    generation: number;
+    serviceEpoch: number;
+    /** 名片内容（与 Runtime 自发的 well-known 卡同源）。 */
+    card: {
+        name: string;
+        description: string;
+        providerOrganization: string;
+        version: string;
+        securityScheme?: {
+            name: string;
+            type: string;
+            keyid?: string;
+            publicKeyPem?: string;
+            algorithm?: string;
+        };
+    };
+    /**
+     * 服务检查（VERIFYING → READY_TO_PUBLISH 的判定）。未配置即抛
+     * SERVICE_CHECK_UNAVAILABLE——绝不做空实现假装检查通过。
+     */
+    serviceCheck?: () => Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    /** 等待门户确认的轮询参数（测试注入短超时）。 */
+    awaitOptions?: {
+        timeoutMs?: number;
+        pollIntervalMs?: number;
+        sleep?: (ms: number) => Promise<void>;
+        now?: () => Date;
+    };
+    /** A2A 路径（缺省 /a2a，与云端路由一致）。 */
+    a2aPath?: string;
+}
+export type BindingReconcileOutcome = 
+/** Catalog 接受后端已确认的商家许可，绑定及发卡完成；服务检查通过才推进上线。 */
+{
+    kind: "advanced";
+    record: OnboardingRecord;
+    confirmed: PublicBinding;
+}
+/** 商家还没完成唯一一次业务授权：记录停在 DEPLOYED_UNBOUND，给出登录确认页和短码。 */
+ | {
+    kind: "awaiting_portal_confirmation";
+    record: OnboardingRecord;
+    hint: string;
+};
+export declare const PORTAL_CONFIRMATION_HINT = "\u8BF7\u6253\u5F00 Catalog \u63D0\u4F9B\u7684\u5B89\u5168\u6388\u6743\u9875\uFF0C\u6838\u5BF9\u5E97\u94FA\u516C\u5F00\u4FE1\u606F\u4E0E\u914D\u5BF9\u7801\uFF0C\u5E76\u70B9\u51FB\u300C\u8FDE\u63A5\u6B64\u670D\u52A1\u5E76\u53D1\u5E03\u300D\u3002\u8FD9\u4E00\u6B21\u786E\u8BA4\u540C\u65F6\u6388\u6743 Runtime \u7ED1\u5B9A\u548C\u540D\u7247\u53D1\u5E03\u3002";
+/**
+ * S3 串联（后台对账）：DEPLOYED_UNBOUND → BOUND → VERIFYING →（服务检查）→
+ * READY_TO_PUBLISH。
+ *
+ * 幂等与断点：先匿名读公开绑定——已确认则跳过请求直接推进；未确认则看证据流，
+ * 没发过请求才发（不重复制造未决请求），随后按超时轮询。轮询超时不是失败：
+ * 返回 `awaiting_portal_confirmation`，记录原处等待，商家确认后重跑即续办。
+ *
+ * 目录不可达：记录 FAILED_RETRYABLE（可重试），不推进、不谎报。
+ */
+export declare function reconcileBinding(record: OnboardingRecord, deps: CatalogPipelineDeps): Promise<BindingReconcileOutcome>;
+/**
+ * S4 串联（向导「确认公开信息」步的副作用部分）：构造名片 → 发布 → CAS 激活。
+ *
+ * **不做状态推进**：返回权威证据，由调用方（向导 advance 通道）经
+ * `store.advance(..., step: "public-profile")` 推进到 PUBLISHED——状态写入只走
+ * 既有通道，保持 CAS 与证据分级单点把关。
+ *
+ * 失败语义（§4.6）：
+ *   - 未确认绑定 → BINDING_NOT_CONFIRMED（不发出任何发布请求）；
+ *   - 目录不可达 → 记录 FAILED_RETRYABLE + `pending_publication` 标记，抛原错误；
+ *   - CAS 冲突（客户端已重读 + 重试一次）→ 记录 BLOCKED，报人工。
+ */
+export declare function publishCardForRecord(record: OnboardingRecord, deps: CatalogPipelineDeps): Promise<AuthoritativeEvidence>;
+/**
+ * 向导 advance 通道的 `platformEvidence` 适配器（M4 api.ts 的形状）。
+ *
+ * 只接管本模块负责的两步：「服务检查」（服务检查回执）与「确认公开信息」
+ * （S4 发布 + 激活）；其余步骤返回 undefined（维持"适配器未配置 → 503"的
+ * 既有行为，绝不代答）。状态不对（如记录不在 READY_TO_PUBLISH）同样返回
+ * undefined——准入判定由向导通道的 checkStepSubmission 给出，本适配器
+ * 不在错误状态下产生副作用。
+ */
+export declare function catalogPlatformEvidenceAdapter(deps: CatalogPipelineDeps): (input: {
+    stepId: string;
+    recordId: string;
+}) => Promise<AuthoritativeEvidence | {
+    kind: "platform_failure";
+    code: string;
+    detail?: string;
+} | undefined>;